Keeps Logging Me Out

  • mtjarrett

    (@mtjarrett)


    8 years, 5 months ago

    I keep getting this as an email:

    Dear Site Admin,

    A user, {myusername}, has been locked out of the WordPress site at http://thetrinitymission.org due to too many bad login attempts.

    The user has been locked out until 2015-11-14 14:20:26.

    To release the lockout please visit the lockouts page.

    *This email was generated automatically by iThemes Security. To change your email preferences please visit the plugin settings.

    This is driving me crazy because I keep getting logged out. How can I stop this?

    Thank you,
    -michael

    https://wordpress.org/plugins/better-wp-security/

Viewing 1 replies (of 1 total)
  • dwinden

    (@dwinden)

    8 years, 5 months ago

    @mtjarrett

    These lockout emails are the symptom of one or more brute force attacks against your website.
    You could simply disable the lockout emails (for which a setting exists) but that is not recommended.

    Your website is probably leaking your WordPress username to login or it is too easy to guess …
    So presumably botnets are trying to brute force your password using that username …
    I sure hope you are using a strong password …
    If not change it to a strong password IMMEDIATELY !

    To stop or at least minimize brute force attacks from hitting your website you could try and enable the iTSec plugin Hide Backend setting. Change the default ‘wplogin’ Login Slug into something only you know (in any case not ‘ttmlogin’ or ‘ttm-admin’).
    Oh by the way, this will generate an extra reminder email …

    And while you are at it set the Multiple Authentication Attempts per XML-RPC Request setting to Block in the WordPress Tweaks section of the iTSec plugin Settings page.

    After these changes you will probably not receive any new lockout emails. But sure let us know if they continue … there is more you can do.

    Next I recommend you create a new administrator user (with a different nickname) and transfer all content to that new user.
    Then delete the old administrator user.
    It’s not safe to use your domain name as a WP user account …

    dwinden

Viewing 1 replies (of 1 total)
  • The topic ‘Keeps Logging Me Out’ is closed to new replies.